File disclosure via manifest path traversal

Path traversal in plugin manifest generation in Microsoft Kiota before 1.29.1 and 1.34.0 allows attackers to disclose files via crafted OpenAPI file references. Kiota copies x-ai-capabilities and x-ai-adaptive-card static_template.file values into response_semantics.static_template.file and validates the raw string before decoding, so percent-encoded traversal sequences, absolute paths, and file or http(s) URIs can pass the safety check and be emitted verbatim. Exposure requires generation from an attacker-controlled or tampered OpenAPI description and later deployment to an AI host that resolves the manifest path, limiting impact to out-of-package file inclusion or disclosure rather than direct code execution in Kiota itself.